Buggy code:
@ Controller public class CollectionRestV3Controller extends BaseController implements ConstantProperties , ParameterProperties { @ Autowired private CollectionBoService collectionBoService ; @ Autowired private CopyCollectionService copyCollectionService ; private static final String INCLUDE_ITEMS = "includeItems" ; @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_ADD } ) @ RequestMapping ( value = { RequestMappingUri . V3_COLLECTION } , method = RequestMethod . POST ) public ModelAndView createCollection ( @ RequestBody final String data , @ RequestParam ( value = FOLDER_ID , required = false ) final String folderId , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_UPDATE } ) @ RequestMapping ( value = { RequestMappingUri . V3_COLLECTION_ID } , method = RequestMethod . PUT ) public void updateCollection ( @ PathVariable ( ID ) final String collectionId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_COPY } ) @ RequestMapping ( value = { RequestMappingUri . V3_SOURCE_COLLECTION_ID } , method = RequestMethod . POST ) public ModelAndView copyCollection ( @ PathVariable ( ID ) final String collectionId , @ RequestParam ( value = FOLDER_ID , required = false ) final String folderId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) throws Exception { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_MOVE } ) @ RequestMapping ( value = { RequestMappingUri . V3_SOURCE_COLLECTION_ID } , method = RequestMethod . PUT ) public void moveCollection ( @ PathVariable ( ID ) final String collectionId , @ RequestParam ( value = FOLDER_ID , required = false ) final String folderId , final HttpServletRequest request , final HttpServletResponse response ) throws Exception { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_ADD } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_RESOURCE } , method = RequestMethod . POST ) public ModelAndView createResource ( @ PathVariable ( ID ) final String collectionId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } <START_BUG> @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_UPDATE } ) <END_BUG> @ RequestMapping ( value = { RequestMappingUri . COLLECTION_RESOURCE_ID } , method = RequestMethod . POST ) public ModelAndView addResource ( @ PathVariable ( COLLECTION_ID ) final String collectionId , @ PathVariable ( ID ) final String resourceId , final HttpServletRequest request , final HttpServletResponse response ) { final User user = ( ( User ) ( request . getAttribute ( USER ) ) ) ; CollectionItem collectionItem = this . getCollectionBoService ( ) . addResource ( collectionId , resourceId , user ) ; collectionItem . setUri ( generateUri ( StringUtils . substringBeforeLast ( request . getRequestURI ( ) , SEPARATOR ) , collectionItem . getCollectionItemId ( ) ) ) ; String [ ] includes = ( ( String [ ] ) ( ArrayUtils . addAll ( CREATE_INCLUDES , ERROR_INCLUDE ) ) ) ; return toModelAndViewWithIoFilter ( collectionItem , RESPONSE_FORMAT_JSON , EXCLUDE_ALL , true , includes ) ; } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_UPDATE } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_RESOURCE_ID } , method = RequestMethod . PUT ) public void updateResource ( @ PathVariable ( COLLECTION_ID ) final String collectionId , @ PathVariable ( ID ) final String collectionItemId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_ADD } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_QUESTION } , method = RequestMethod . POST ) public ModelAndView createQuestion ( @ PathVariable ( ID ) final String collectionId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_ADD } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_QUESTION_ID } , method = RequestMethod . POST ) public ModelAndView addQuestion ( @ PathVariable ( COLLECTION_ID ) final String collectionId , @ PathVariable ( ID ) final String questionId , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_UPDATE } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_QUESTION_ID } , method = RequestMethod . PUT ) public void updateQuestion ( @ PathVariable ( COLLECTION_ID ) final String collectionId , @ PathVariable ( ID ) final String collectionItemId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_UPDATE } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_ITEM_ID } , method = RequestMethod . PUT ) public void updateCollectionItem ( @ PathVariable ( COLLECTION_ID ) final String collectionId , @ PathVariable ( ID ) final String collectionItemId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_DELETE } ) @ RequestMapping ( value = { RequestMappingUri . COLLECTION_ITEM_ID } , method = RequestMethod . DELETE ) public void deleteCollectionItem ( @ PathVariable ( COLLECTION_ID ) final String collectionId , @ PathVariable ( ID ) final String collectionItemId , @ RequestBody final String data , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_READ } ) @ RequestMapping ( value = { RequestMappingUri . V3_COLLECTION_ID } , method = RequestMethod . GET ) public ModelAndView getCollection ( @ PathVariable ( ID ) final String collectionId , @ RequestParam ( value = CollectionRestV3Controller . INCLUDE_ITEMS , required = false , defaultValue = FALSE ) final boolean includeItems , final HttpServletRequest request , final HttpServletResponse response ) { } @ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_READ } ) @ RequestMapping ( value = { RequestMappingUri . ITEM_ID }

Fix:
@ AuthorizeOperations ( operations = { GooruOperationConstants . OPERATION_SCOLLECTION_ADD } )